Collabora Built-in CODE Server for Nextcloud (CVE-2026-110447): OS command injection exploited to plant web shells

What happened

CVE-2026-110447 is an OS command injection in proxy.php of the richdocumentscode Nextcloud app, which bundles a Collabora Online (CODE) server inside Nextcloud. A crafted request runs an operating system command as the web server user. It needs no login and no user interaction, but only works while the built-in CODE server is not running, for example after a container restart, an upgrade or a crash. It is rated CVSS 4.0 9.2. Collabora says it is a different path from CVE-2025-66208, and that fix does not stop it (Collabora GHSA-g3vx-3m76-fghh).

The CVE record says it was “exploited in the wild in September and October 2026” (CVE record). A Nextcloud community forum thread warned users on 3 October. One user found apps/richdocumentscode/Nx_33143.php containing a one-line system($_GET[c]) web shell; others reported shells named shx* and shrf* (Nextcloud forum). Collabora published its advisory, naming 26.4.303 as the fixed version, on 14 October. CISA added the CVE to the KEV catalog on 23 October 2026, with a federal due date of 26 October, and requires forensic triage (CISA KEV).

Why this matters

Turning the app off does not close the hole. Collabora’s advisory says disabling the app is not enough; you must upgrade or remove it (Collabora). Forum users add that a disabled app could already have been used. And the bug is only reachable when the CODE server is down, so servers that were restarted or upgraded in September and October were most exposed, even if the app looked healthy afterwards.

Am I affected?

You are affected if richdocumentscode is installed at a version below 26.4.303. Not affected: installs using richdocuments without richdocumentscode, Collabora run in Docker or from a distribution package, and hosted Collabora services (Nextcloud forum).

# Run from the Nextcloud directory as the web server user
sudo -u www-data php occ app:list | grep -A1 richdocumentscode

# Even if the app is disabled, check whether its files are still on disk
ls -la apps/richdocumentscode/ 2>/dev/null

Look for web shells. Any PHP file in the app folder that is not part of the app is suspect:

# PHP files changed since the attacks began
find apps/richdocumentscode -name '*.php' -newermt 2026-09-01 -ls

# Names reported on the Nextcloud forum
find . -path '*richdocumentscode*' \( -name 'Nx_*.php' -o -name 'shx*' -o -name 'shrf*' \) -ls

# Nextcloud's own integrity check for the app
sudo -u www-data php occ integrity:check-app richdocumentscode

The forum report flagged the shell as EXTRA_FILE in Nextcloud’s integrity scan. The reported SHA-512 of Nx_33143.php is 4b1c4012c882c512b1e4bb2938c554359f6a268f2a5d10471dbf6d08cce31c7b0e8cc24e5f709dc227fc3e2a34f685089219be2df4713f1a9933348ef4cbfe82 (Nextcloud forum).

Check web logs for requests to the proxy with a status query, back to at least 10 September, as forum users advise:

grep -h 'richdocumentscode/proxy.php?status' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null

Then look for requests to any PHP file under apps/richdocumentscode/ other than proxy.php, which would be someone using a planted shell.

What to do now

1. Update richdocumentscode to 26.4.303 with sudo -u www-data php occ app:update richdocumentscode, or remove the app and its folder. Version 26.4.303 needs Nextcloud 30 or later; on Nextcloud 29 or older, upgrade Nextcloud or remove the app (Collabora).
2. Consider a standalone Collabora server (Docker or distribution package) with the richdocuments connector. That setup is not affected.
3. Remove planted files and treat the server as compromised if you find any. A shell ran as the web server user, so look for further files outside the app folder and for cron entries owned by that user.
4. Rotate what the web server user could read, as forum users recommend: the database password in config/config.php, Nextcloud app passwords, and any storage or SMTP credentials in the configuration.
5. Preserve logs before cleaning up. CISA requires forensic triage for this KEV entry, and the access logs are your only record of what the shell was used for.

Sources

• Collabora advisory GHSA-g3vx-3m76-fghh
• CVE record: CVE-2026-110447
• Nextcloud community forum: To Collabora Built-in users, update ASAP
• CISA KEV entry: CVE-2026-110447